Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rust’s dependencies are starting to worry me

vincents.dev

Post reply on HN
Print view View original

401–410 of 593 posts

Re: Rust’s dependencies are starting to worry me

#401

Post by bsrkf »

mustache_kimono wrote: post #315
bsrkf wrote: post #208

Excuse me for not having much to add to the discussion but two interesting references for people to check out, if so inclined of course: a) Ginger Bill (the Odin language creator, no affiliation) stated on a podcast that Odin will never have an official pkg manager, since what they're, in his opinion, mainly automating is dependency hell, and this being one of the main reasons for rising software complexity and lower…

> a)... Odin will never have an official pkg manager Perhaps this explains why Odin has found such widespread usage and popularity. /s > b)... Jonathan Blow, who's talk "Preventing the Collapse of Civilization" With such a grandiose title, before I first watched I thought it must be satire. Turns out, it is food for the credulous. I believe Jonathan Blow is less "seriously worried about software quality/complexity" t…

  "Perhaps this explains why Odin has found such widespread usage and popularity. /s"
What an unnecessarily snark and dismissive comment to make about someone's work.

  - I'd say within a certain niche Odin is becoming well known and gets its use
  - you do realize using an `Odin package` is putting a program into a sub-folder and that's it
  - It comes with a rich stdlib + vendor libraries out of the box
  - and isn't it kind of up to the creators how to design and promote their language
I'd even argue it's laudable a language doesn't promote itself as a "fixes everything use me at all costs" kind of technology. The creator himself tells people it might not be the right tool for them/their use case, encourages them to try other languages too, sometimes outright tells them Odin doesn't fit their needs and xyz would probably do better.

Odin is pragmatic & opinionated in its language design and goal. Maybe the lack of a package manager is the basis for you to disregard a programming language, for plenty of others (and likely more Odin's target group) it's the least of their concerns when choosing a language.

Re: Rust’s dependencies are starting to worry me

#402

Post by quotemstr »

nosianu wrote: post #382
bilbo-b-baggins wrote: post #266

Earlier quoted context omitted.

Symbol culling and dead code removal is already a thing in modern compilers and linkers, and rust can do it too: https://github.com/johnthagen/min-sized-rust

As others have pointed out elsewhere, that only removes static dependencies. If you have code paths that are used depending on dynamic function arguments static analysis is unable to catch those. For example, you have a function calling XML or PDF or JSON output functions depending on some output format parameter. That's three very different paths and includes, but if you don't know which values that parameter can ta…

The situation isn't quite as dire as you portray. Compilers these days can also do devirtualization. The consequent static calls can become input to tree shaking in the whole program case. While it's true that we can't solve the problem in general, there's hope for specific cases.

Re: Rust’s dependencies are starting to worry me

#404

Post by uecker »

simonask wrote: post #327
uecker wrote: post #253

Earlier quoted context omitted.

That does not help you if the bug is one of many unmaintained crates and never noticed. Linux distributions aim to make sure that C application dynamically link to the right libraries instead of vendoring the code. Then the library can be updated once. IMHO this is the only reasonable approach.

It's trivial to see on crates.io whether a crate is unmaintained.

Maybe if it is completely unmaintained, but this is not enough to solve the problem and maybe also not really the point.

Re: Rust’s dependencies are starting to worry me

#405

Post by orphea »

kouteiheika wrote: post #397
whstl wrote: post #391

Earlier quoted context omitted.

I would say compared to other languages Rust feels even more lacking. All those AFAIR need 3rd party packages: Regex, DateTime, base64, argument parsing, url parsing, hashing, random number generation, UUIDs, JSON I'm not saying it's mandatory, but I would expect all those to be in the standard library before there is any http functionality.

> All those AFAIR need 3rd party packages: Regex Regex is not 3rd party (note the 'rust-lang' in the URL): https://github.com/rust-lang/regex

3rd party relative to the standard library. In other words: not included.

Re: Rust’s dependencies are starting to worry me

#406

Post by okanat »

whstl wrote: post #391
iTokio wrote: post #300

Earlier quoted context omitted.

I think this is partially true, but more nuanced than just saying that Rust std lib is lacking. Compared to go and c#, Rust std lib is mostly lacking: - a powerful http lib - serialization But Rust approach, no Runtime, no GC, no Reflection, is making it very hard to provide those libraries. Within these constraints, some high quality solutions emerged, Tokio, Serde. But they pioneered some novel approaches which wou…

I would say compared to other languages Rust feels even more lacking. All those AFAIR need 3rd party packages: Regex, DateTime, base64, argument parsing, url parsing, hashing, random number generation, UUIDs, JSON I'm not saying it's mandatory, but I would expect all those to be in the standard library before there is any http functionality.

Having some of those libraries listed and then not being able to change API or the implementation is what killed modern C++ adoption (along with the language being a patchwork on top of C).

As some of the previous commenters said, when you focus your language to make it easy to write a specific type of program, then you make tradeoffs that can trap you in those constraints like having a runtime, a garbage collector and a set of APIs that are ingrained in the stdlib.

Rust isn't like that. As a system programmer I want none of them. Rust is a systems programming language. I wouldn't use Rust if it had a bloated stdlib. I am very happy about its stdlib. Being able to swap out the regex, datetime, arg parsing and encoding are a feature. I can choose memory-heavy or cpu-heavy implementations. I can optimize for code size or performance or sometimes neither/both.

If the trade-offs were made to appease the easy (web/app) development, it wouldn't be a systems programming language for me where I can use the same async concepts on a Linux system and an embedded MCU. Rust's design enables that, no other language's design (even C++) does.

If a web developer wants to use a systems programming language, that's their trade-off for a harder to program language. The similar type safety to Rust's is provided with Kotlin or Swift.

Dependency bloat is indeed a problem. Easy inclusion of dependencies is also a contributing factor. This problem can be solved by making dependencies and features granular. If the libraries don't provide the granularity you want, you need to change libraries/audit source/contribute. No free meals.

Re: Rust’s dependencies are starting to worry me

#407

Post by weltensturm »

Rust has a million ways to solve a specific problem, as it is not opinionated and gets you down to the lowest level if needed. On top of that there's a million ways to encode your types. Then there's a million ways to bind C libraries.

The solution space is basically infinite, and that's a good thing for a systems programming language. It's kind of amazing how far rust reaches into higher level stuff, and I think the way too easy to use package manager and lively crate ecosystem is a big part of that.

Sometimes I wish for a higher-level rust-like language though, opinionated as hell with garbage collector, generic functions without having to specify traits, and D's introspection.

Re: Rust’s dependencies are starting to worry me

#408

Post by Const-me »

Ygg2 wrote: post #330
merb wrote: post #302

Earlier quoted context omitted.

actually dotnet also does not need too many dependencies for games and desktop apps.

So it comes out of box with good renderers, physics engines, localization, input controllers and in-game GUIs?

The libraries you listed are too specialized. And they require integration with asset pipeline which is well outside of scope of a programming language.

As for the generic things, I think C# is the only mainstream language which has small vectors, 3x2 and 4x4 matrices, and quaternions in the standard library.

Re: Rust’s dependencies are starting to worry me

#409

Post by okanat »

whstl wrote: post #398
f_devd wrote: post #226

Earlier quoted context omitted.

let uri: Uri = get_uri_from_stdin().parse()?; If the library is made in a modular way this is how it would typically be done. The `HTTP` may be inferred by calls further along in the function.

So what happens if the user passes an url containing ftp:// or even https:// to stdin? Or is this an HTTP only library?

See, the trait system in Rust actually forced you to discover your requirements at a very core level. It is not a bug, but a feature. If you need HTTPS, then you need to include the code to do HTTPS of course. Then LTO shouldn't remove it.

If your library cannot parse FTP, either you enable that feature, add that feature, or use a different library.

Re: Rust’s dependencies are starting to worry me

#410

Post by jstanley »

weltensturm wrote: post #407

Rust has a million ways to solve a specific problem, as it is not opinionated and gets you down to the lowest level if needed. On top of that there's a million ways to encode your types. Then there's a million ways to bind C libraries. The solution space is basically infinite, and that's a good thing for a systems programming language. It's kind of amazing how far rust reaches into higher level stuff, and I think the…

Have you tried Go?
Post reply on HN